Timeline for Weakness when encrypting using RSA private key?
Current License: CC BY-SA 4.0
16 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jul 19 at 9:08 | vote | accept | Ralf | ||
| S Jun 18 at 9:02 | history | bounty ended | CommunityBot | ||
| S Jun 18 at 9:02 | history | notice removed | CommunityBot | ||
| Jun 14 at 21:31 | answer | added | Geoffroy Couteau | timeline score: 4 | |
| Jun 12 at 7:30 | comment | added | Ralf | @fgrieu Thanks, that's exactly the type of weaknesses I'm looking for | |
| Jun 11 at 3:36 | comment | added | Mikero | Are you proposing anything other than just changing how you use English to label the values in RSA? | |
| Jun 10 at 14:15 | comment | added | fgrieu♦ | @Ralf: The above misses at least one consideration. If we "switch the public and private keys", then the originally-named-public exponent must be large enough (beside secret). If it's below about $N^{ 0.292}$, and the originally-private key is made public, then the now-secret exponent can be found by this method. | |
| Jun 10 at 7:42 | comment | added | Ralf | @MaartenBodewes After reading up more about this, I understand, public and private keys are "symmetrical" - you can switch the two around. $(m^e)^d \equiv m \ (\text{mod} \ n)$, and $(m^d)^e \equiv m \ (\text{mod} \ n)$ - there is no mathematical difference between those two. One big difference comes in if you additionally store the private factors $p$ and $q$ together with the private key, since those could be used to derive both keys. Another practical difference could be the relative size of $e$ vs $d$, which affects performance and level of security. | |
| S Jun 10 at 7:39 | history | bounty started | Ralf | ||
| S Jun 10 at 7:39 | history | notice added | Ralf | Draw attention | |
| Jun 9 at 2:49 | comment | added | Maarten Bodewes♦ | No, you cannot switch the public and private key around like you are suggesting at the end of your question. The key pair is generated using a specific way and although both the public exponent and private exponents are used as - well - exponents that doesn't make them identical. I always understood that this is secure if the public exponent is as large as the private exponent, but 1. that might be wrong altogether and 2. your public exponent is much smaller than the private exponent which should also be in the order of 1024 bits. | |
| Jun 7 at 15:06 | comment | added | Ralf | @DannyNiu I don't have good info on this, but here is some code that I presume is based on reverse engineering the original client: https://github.com/yushulx/South-Africa-driving-license/blob/main/sadl/__init__.py. The original description of the scheme is here, but doesn't have much info: https://pastebin.com/gb049dfx. | |
| Jun 7 at 14:32 | history | edited | Ralf | CC BY-SA 4.0 |
added 457 characters in body
|
| Jun 7 at 14:25 | comment | added | DannyNiu | Do you have a source for this (e.g. URL, book name, etc.). I think it's some form of signature with message recovery (when signature with appendix is more common nowadays). | |
| S Jun 7 at 14:19 | review | First questions | |||
| Jun 8 at 15:10 | |||||
| S Jun 7 at 14:19 | history | asked | Ralf | CC BY-SA 4.0 |